What
Environment variables that policy settings are meant to strip can no longer be smuggled through by changing their case.
Details
- the
ANTHROPIC_UNIX_SOCKET-related stripping moved from destructuring fixed key names to an uppercase set lookup, andNO_COLOR/FORCE_COLORhandling did the same - per-helper env allowlists were introduced for
apiKeyHelper,awsAuthRefresh,awsCredentialExportandgcpAuthRefresh, plus a list of OTel logging variables
Evidence
ANTHROPIC_BEDROCK_MANTLE_BASE_URL
Strings lifted out of the shipped bundle, so the claim above can be checked against them.